--- title: "Detecting and removing dangerous secrets on dev workstations before Shai-Hulud does" url: https://daily.dev/posts/detecting-and-removing-dangerous-secrets-on-dev-workstations-before-shai-hulud-does-2hraewyha source_url: https://recyclebin.zip/posts/2026-05-25-secret-scanning-fleet-bagel type: article source: "Tech Lead Digest" published: 2026-06-15T01:21:04.547Z updated: 2026-06-15T01:21:25.102Z tags: ["security"] reading_time: 6 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Detecting and removing dangerous secrets on dev workstations before Shai-Hulud does **[Tech Lead Digest](https://daily.dev/sources/techleaddigest)** · 6 min read · 1 upvotes · 0 comments ## Summary Software supply chain malware increasingly targets secrets stored in plaintext on developer workstations. This post presents a practical open-source approach combining bagel (a Go-based secret scanner for home directories), Fleet (an MDM/osquery platform), and a proof-of-concept glue repo called Fleebag. Bagel runs on a schedule via LaunchAgent, outputs JSON findings, and Fleet policy queries check for critical secrets and can block non-compliant workstations from logging in via IdP integration (e.g., Entra Conditional Access). The post also outlines gaps: no code signing, no secret removal automation, and no visibility into already-exposed credentials. Alternatives for safer secret storage like 1Password developer tools and YubiKeys are mentioned. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Every Laptop Is a Credential Store: Complete Map of Hidden Secrets](https://daily.dev/posts/every-laptop-is-a-credential-store-complete-map-of-hidden-secrets-u5zc0z2jm) · GitGuardian · 0 upvotes · 0 comments - [HashiCorp Warns Traditional Secret Scanning Tools Are Falling Behind](https://daily.dev/posts/hashicorp-warns-traditional-secret-scanning-tools-are-falling-behind-kyfjcztok) · InfoQ · 1 upvotes · 0 comments - [Protecting Developers Means Protecting Their Secrets](https://daily.dev/posts/protecting-developers-means-protecting-their-secrets-yjouvaqhk) · GitGuardian · 0 upvotes · 0 comments - [Protecting Developers Means Protecting Their Secrets](https://daily.dev/posts/protecting-developers-means-protecting-their-secrets-3i6xn3xnm) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/detecting-and-removing-dangerous-secrets-on-dev-workstations-before-shai-hulud-does-2hraewyha)